Understanding the Decision-Making of Experienced Incident Responders during Critical Cyberattacks on Swiss Organizations

Description

Cyberattacks are a threat to organizations worldwide, yet how organizations respond is still poorly understood. Existing research has focused mainly on organizational aspects of incident response teams, while the individual cognitive processes that shape responders’ judgments under high stress and uncertainty during actual incidents remain largely unexplored. Our project applies the Naturalistic Decision-Making approach, widely used in other high-risk domains such as firefighting and emergency medicine, to understand what decisions are made by experienced responders, how they integrate intuition and deliberate analysis, and what cues they rely on.

We will conduct in-depth case studies of real-world incidents in Swiss victim organizations. Access to victims and exchange of domain knowledge is facilitated by a consortium of practice partners, including the International Forum of Incident Response and Security Teams, the Healthcare Cyber Security Center (22 hospitals), the Financial Service Cyber Security Center (170 financial institutions), a CISO network, and the Digital Crime Investigation Support Network (cantonal police forces). The expected contributions are both scientific and societal: with the first multi-case study of victim organizations, we will advance theory in a societally highly relevant area. This will also form the basis for evidence-based recommendations, such as new trainings and decision-support tools that strengthen the cyber resilience of organizations of all sizes, including SMEs and public institutions such as schools.

Key data